Mohamed Ghenaïm

1. HEAD → missionJune 2026 – present

   CA-GIP, Crédit Agricole Group Infrastructure Platform

   Cloud & DevOps Architect, sovereign generative AI platform (Mistral AI)

   Technical lead for the build of the group's Mistral AI GenAI platform, on-premise on air-gapped OpenShift (NVIDIA B300 GPUs) and on AWS EKS. Driving force behind design and go-live, in a team of four.

   on-prem/openshift-airgapped

   • Deployment and version upgrades of the Mistral AI stack in sandbox, DEV and PROD, with a Helm chart adapted to OpenShift.
   • Migration from ArgoCD to FluxCD on my own initiative: per-application GitOps organisation, documentation, team upskilling.
   • Deployment and tuning of models with vLLM (Mistral Small 4, Medium, Large, OCR, Voxtral, Embed).
   • Benchmarks of LLM endpoints with GuideLLM and identification of bottlenecks.
   • Observability of nodes, workloads, vLLM inference and GPUs (Tensor Cores, temperature, power draw) with Grafana and alerting, Dynatrace and Kibana.
   • CNPG PostgreSQL databases backed up to on-prem S3, restores tested and validated.
   • Model and backup storage migrated to on-prem S3, automated model synchronisation in the air-gapped environment.
   • Secrets with HashiCorp Vault and External Secrets, PVC encryption.
   • In-cluster Redis on an image built in GitLab CI, replacing an unsuitable managed service.
   • Go-live of the application and inference clusters: network flows, security validation, platform base, together with the network and security teams and the vendor.
   • Recovery of an internal RAG application after a data-loss incident.

   aws/eks

   • Mistral AI stack deployed on EKS across all environments, from DEV to PROD.
   • Exposure through Network Load Balancers, evaluation of EKS Auto Mode.
   • RDS Proxy for connection pooling to RDS databases.
   • Automated creation of Keycloak user accounts.
   • Secrets in AWS Secrets Manager, encrypted with a KMS key backed by CloudHSM.

   Stack: openshift, eks, helm, fluxcd, vllm, guidellm, grafana, dynatrace, cnpg, vault, keycloak, kms, cloudhsm

2. epex-spotJul. 2025 – Sep. 2025

   EPEX SPOT

   AWS Cloud Architect, Foundation team

   Architecture and deployment of the critical AWS building blocks of a platform being migrated. Standardised Terraform modules for the DevOps teams.

   • Hybrid Route 53 DNS: central DNS Hub in Terraform, connected to the datacenter through Direct Connect and DX Gateway, shared via Organizations and RAM. Asymmetric routing solved with Network Firewall.
   • Managed PKI with AWS PCA: Root and Subordinate CA hierarchy in Terraform, cross-account sharing, automatic ACM renewal.
   • GitLab Runners infrastructure rebuilt as IaC after a major incident, with no interruption to deployments.
   • GitLab runners module on EC2: autoscaled manager and workers (AWS fleeting plugin), standardised Debian AMI built with Packer.
   • Terraform module catalogue: gitlab-runner, pki-certificate, dns-record, ecr-repository, codeartifact-repository.
   • Tag-based stop and start of resources via Lambda, outside business hours: −60 % EC2 cost.
   • Architecture documentation (ADRs), operational guides and AWS upskilling of the team.

   Stack: terraform, route53, direct-connect, network-firewall, aws-pca, acm, gitlab-ci, packer, lambda

3. claranetDec. 2022 – Jan. 2025

   Claranet France

   AWS CloudOps, Cloud Native BU

   Production build and run on multi-account AWS environments for 11 clients: fintech, real estate (CAC 40), streaming, IoT, pharma, banking, e-commerce.

   • L3 support and night on-call across the whole portfolio.
   • Complete ECS stack: PHP Docker images, IAM, ECR, task definitions, RDS, ALB, Route 53, ACM, HashiCorp Vault secrets.
   • Splunk and OpenTelemetry monitoring on EC2 and ECS.
   • Patch management: AMIs migrated from Ubuntu to Debian, GitLab Runners and Docker Machine upgraded.
   • Ansible playbook for application deployment on EC2.

   Stack: ecs, ecr, rds, alb, route53, vault, splunk, opentelemetry, ansible

4. orangeOct. 2020 – Dec. 2022

   Orange France

   Linux / DevOps Production Engineer, Portal Common Service

   • Build of the high-traffic URL redirection service: migration from Ubuntu 14.04 to 18.04, Apache, IP addressing, Ansible playbook.
   • L3 support for the Orange Portal production.
   • Shared GitLab CI pipeline templates for all IT teams.
   • Migration of services to Kubernetes and CloudFoundry, Kibana dashboards for production monitoring.
   • DAM application (Nuxeo) migrated to Docker Swarm: optimised Dockerfile, CI/CD pipelines, HTTPS certificates.

   Stack: apache, ansible, gitlab-ci, kubernetes, cloudfoundry, docker-swarm, kibana

5. malakoff-humanisSep. 2017 – Sep. 2020

   Malakoff Humanis

   Linux Infrastructure Production Engineer, CSI/Linux team

   • Linux infrastructure administration: Bash, Nagios, LDAP, Kerberos.
   • Complete ELK cluster (Elasticsearch, Logstash, Kibana, Kafka, Zookeeper) on Docker Swarm.
   • CI/CD automation with Rundeck, Ansible, Docker, GitLab and Jenkins. ITSM with GLPI and FusionInventory.
   • RedHat Satellite (channels, hosts) and Identity Manager.

   Stack: rhel, elk, kafka, docker-swarm, rundeck, ansible, jenkins, satellite

# Skills, by domain
resource "skills" "cloud_iac" {
  aws   = ["EKS", "Secrets Manager", "KMS", "CloudHSM"]
  tools = ["Terraform", "Packer", "Ansible", "Hetzner (dedicated)"]
}

resource "skills" "containers" {
  runtime = ["Kubernetes", "OpenShift", "K3s", "Docker"]
  gitops  = ["Helm", "FluxCD", "ArgoCD"]
}

resource "skills" "network_security" {
  mesh    = ["Cilium", "Linkerd"]
  secrets = ["Vault", "External Secrets", "SOPS", "Infisical", "Keycloak"]
}

resource "skills" "ai_llm" {
  serving = ["vLLM", "GuideLLM", "LiteLLM", "Mistral AI", "Ollama"]
  usage   = ["RAG", "embedding pipelines", "n8n AI Agents"]
}

resource "skills" "data" {
  databases = ["PostgreSQL (CNPG, Barman)", "Redis", "MongoDB", "S3"]
  vectors   = ["Qdrant", "pgvector"]
}

resource "skills" "observability" {
  tools = ["Grafana", "Prometheus", "Datadog", "Dynatrace", "Splunk", "New Relic", "ELK"]
}

resource "skills" "ci_cd" {
  tools = ["GitLab CI", "Artifactory", "Rundeck", "n8n"]
}

resource "skills" "ai_assisted_dev" {
  claude_code = ["Rust", "Python / FastAPI", "TypeScript / React", "Tauri", "Alpine.js"]
}

Plan: 8 to add, 0 to change, 0 to destroy.

README.md: designed, architected, deployed and operated by me. The applications are developed with Claude Code.